Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety, By Eric Schlosser, Penguin, 632 pp., $36
Eric Schlosser has written a strange and powerful book about the risks that an American nuclear weapon might go off by accident, through sabotage, or because of a false warning of attack. Strange because Command and Control is really two books in one: the first, a detailed and moving account of a serious accident that occurred with a Titan II nuclear-armed missile in 1980 near Damascus, Arkansas; the second, a comprehensive political history of U.S. nuclear strategy, Cold War crises, and the technical efforts in weapons laboratories to improve the safety and security of America’s nuclear arsenal. The book is powerful because the micro-accident and macro-political stories, repeatedly interwoven in consecutive chapters, reinforce each other by highlighting the improbability that normal fallible human beings, working in normal imperfect organizations, can somehow create an infallible nuclear arsenal, always available for use on a moment’s notice, but never without authorization.
The Titan II missile that blew up in the middle of the night of September 18, 1980, was the height of a nine-story building, filled with about 85,000 pounds of rocket fuel and 163,000 pounds of liquid oxidizer, and tipped with a nine-megaton W-53 thermonuclear warhead. This warhead was the largest-yield hydrogen bomb in the American nuclear arsenal, more than 600 times as powerful as the “small” atomic bomb that destroyed Hiroshima. The Damascus accident, like many others described in less detail in the book, began in a most prosaic manner. A 21-year-old missile repairman, during “on-the-job training,” dropped the socket off a socket wrench he was using to remove a small pressure cap. It fell about 70 feet and ricocheted into the Titan II, piercing its skin and causing highly flammable liquid fuel to spray out “like water from a garden hose.” Inside the silo, heat was rising to dangerous levels as volatile rocket fuel escaped, but senior officers at the Strategic Air Command headquarters overruled the local commander’s plan to open the silo hatch and vent the vapors into the night air. They feared that if the missile blew up with the silo hatch open, the warhead would be launched, and as Schlosser puts it, they “didn’t want a thermonuclear weapon landing in a backyard somewhere between Little Rock and St. Louis.” Instead, two young missile mechanics—Jeff Kennedy and David Livingston—bravely entered the dark missile control center, now filled with deadly vapor, to find a way to stop the leakage. When Livingston flipped the switch for a fan, it created a spark that caused the vapor to ignite. The Titan II exploded, with enough force to launch the missile through the bolted nine-ton silo hatch. The nine-megaton warhead landed 200 yards from the silo. The final arming mechanisms had not been activated, and the conventional explosives inside the warhead casing did not go off. Schlosser reports, with only a limited sense of relief, that “alpha radiation was detected directly on top of the weapon, but nowhere else on the complex.”
Livingston soon died from his injuries. And as often happens in organizations after a deadly accident, the Air Force soon blamed the victim, not the designers of the system or the more senior officers in charge of emergency procedures, asserting that Livingston had not been ordered to turn on the fan—a claim Kennedy strongly disputed, Schlosser notes. The Damascus accident and other incidents did, however, lead to many important safety improvements: the use of solid fuel instead of liquid fuel for missiles, the development of less-sensitive conventional high explosives to detonate the fissile cores of nuclear bombs, and sophisticated new safety devices, such as a strong-link/weak-link circuit breaker, to prevent the detonation of a warhead if accidentally dropped or exposed to fire.If Livingston and Kennedy are the heroes of the book’s accident story, those of its larger Cold War nuclear history are the Sandia National Laboratory officials who designed the new safety systems and, over time, were able to persuade high-level Pentagon authorities to have them placed into the U.S. nuclear arsenal, often despite opposition from senior Air Force civilians and officers who feared a loss of military readiness. Senior Sandia engineers, such as Stan Spray and Bob Peurifoy, worked tirelessly for safer and more reliable weapons and fought against the parochial organizational tendency to cover up failures. “I believe that the Titan missile system is a perfectly safe system to operate,” the secretary of the Air Force told the press after the Damascus events, casually adding that “accidents happen.”
It may be tempting for some readers of Command and Control to assume that with the end of the Cold War and the advent of more modern, safer nuclear weapons, the threat of nuclear accidents has passed. But Schlosser demonstrates, powerfully and persuasively, that such a belief is an illusion. Indeed, layering on safety devices and personnel checks can produce what I like to call “the problem of redundancy problem.” Each additional precaution makes a system more complex and encourages a false sense of confidence among its operators. A recent case in point is the August 2007 Minot-Barksdale incident, in which six nuclear-armed cruise missiles were accidentally placed under the wings of a B-52 bomber. No one double-checked what kind of missiles they were because everyone assumed someone else would do it. The pilots thought they were ferrying conventional-armed weapons from Minot Air Force Base in North Dakota to the Barksdale base in Louisiana. The plane sat on runways at both ends of its journey for more than 24 hours without the special armed guards normally assigned to protect nuclear weapons. If anything, Schlosser’s brief account of this incident underestimates the risks it posed. Had the B-52 experienced a problem in flight or crashed on landing, the pilots would not have followed the proper nuclear emergency procedures, such as jettisoning the cruise missiles if necessary, because they had no idea what they were transporting.
What can be done? Schlosser ends by outlining the current debate between advocates of mutual nuclear disarmament and advocates of continued reliance on nuclear deterrence. He suggests a middle position, a “minimum deterrence” strategy that would require maintaining just a few hundred weapons. That is a valuable goal. The most important lesson of this powerful book, however, is that whatever goals or policies we advocate with regard to our nuclear arsenal, none of them requires that we keep more than a thousand nuclear weapons on a hair trigger. Schlosser’s account reminds us that accidents will happen and that current U.S. nuclear policy too often appears to assume otherwise.
